Compliance: missing-dependencies-label

[don-petry]

Compliance Finding

Category: dependabot
Severity: warning
Check: missing-dependencies-label

Detail

Dependabot config missing dependencies label on updates

Standard Reference

standards/dependabot-policy.md#policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Claude finished @don-petry's task in 1m 47s —— View job • claude/issue-55-20260508-1409 • Create PR ➔

---

Fixing Compliance Issue: missing-dependencies-label

• Check for existing open PRs for this issue
• Read CLAUDE.md for repo-specific instructions
• Read current dependabot config and standards
• Create root .github/dependabot.yml with dependencies + security labels
• Fix frameworks/spec-kit/.github/dependabot.yml to add missing labels
• Commit and push changes
• Create PR

Summary

Two changes to bring the repo into compliance with the dependabot policy:

1. Created .github/dependabot.yml — the root repo was missing a dependabot config entirely. Added the github-actions ecosystem entry (the only relevant ecosystem for this repo) with security and dependencies labels.

2. Fixed frameworks/spec-kit/.github/dependabot.yml — added security + dependencies labels to both pip and github-actions entries, and set open-pull-requests-limit: 0 on pip (security-only per policy) and 10 on github-actions (version updates allowed).

[don-petry]

Weekly Compliance Audit (2026-05-11)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy

[don-petry]

Weekly Compliance Audit (2026-05-13)

This finding is still open.

Detail: Dependabot config missing dependencies label on updates

Standard: standards/dependabot-policy.md#policy